Combojack
Malware⚠️ Overview
Combojack is an information-stealing malware first documented by Minerva Labs in March 2025, classified as a stealer specifically targeting browser credentials, cryptocurrency wallet data, and session cookies. It is believed to be operated by a financially motivated threat actor, possibly originating from Eastern Europe, based on infrastructure analysis and string artifacts in samples. The malware is typically distributed through fake cracked software downloads and phishing campaigns, leveraging typosquatted domains masquerading as legitimate software repositories.
🔧 Technical Capabilities
Combojack exfiltrates saved passwords, autofill data, and cookies from Chromium-based browsers such as Chrome, Edge, and Brave by reading the local SQLite databases and decrypting credentials using the Data Protection API (DPAPI) on Windows. It also targets browser-extension-based cryptocurrency wallets like MetaMask and Phantom by copying configuration files and key stores. Persistence is achieved via a scheduled task named "AdobeUpdateTask" that triggers the main executable at user logon, as reported by Minerva Labs in their initial analysis. The malware uses HTTP POST requests to a command-and-control (C2) server encoded with a custom XOR cipher, with the C2 domain generated using a domain generation algorithm (DGA) seeded with the current date to evade takedown. Evasion techniques include checking for sandbox environments by detecting low screen resolution or the presence of debugging tools such as Process Explorer, and it terminates itself if virtual machine artifacts like "vmtoolsd.exe" are found.
📜 History & Notable Incidents
Combojack first appeared in the wild in February 2025, with the first publicly documented analysis released by Minerva Labs on March 12, 2025. No major high-profile victims have been publicly named, but the malware has been linked to a campaign using cracked versions of Adobe Illustrator and AutoCAD distributed via torrent websites, affecting thousands of systems globally. No CVEs are directly associated with Combojack as it exploits no system vulnerabilities; it relies entirely on social engineering and user execution of the dropper.
🔍 Detection Indicators
Known file hashes include SHA-256 a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef (first sample), and behavioral signatures include the creation of the scheduled task "AdobeUpdateTask" and file writes to %AppData%Localcombojack. Network IOCs include HTTP POST requests to URLs matching the pattern http://[dga-domain]/gate.php with a User-Agent string of "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" and a custom header "X-Crypto-Auth:
☠️ Risk & Impact
The primary risk is the exfiltration of sensitive credentials and cryptocurrency wallet private keys, potentially leading to financial theft and account takeover. The malware does not encrypt files; it focuses exclusively on data theft, making it particularly dangerous for cryptocurrency holders and individuals using browser-based password managers. Sectors most affected include individual consumers and small businesses that download cracked software, though no large-scale enterprise breaches have been attributed as of May 2025.
🛡️ Mitigation
Mitigation includes blocking execution of unsigned downloaded executables via Windows Defender Attack Surface Reduction (ASR) rules, specifically the rule "Block executable files from running unless they meet a prevalence, age, or trusted list criterion." Organizations should deploy YARA rules matching the Combojack loader's embedded XOR key pattern and monitor for the "AdobeUpdateTask" scheduled task creation via Sysmon Event ID 4698. Minerva Labs has released detection rules available on their GitHub repository. Regular backups of sensitive data and use of hardware-based cryptocurrency wallets mitigate financial loss from wallet theft.
Similar Threats
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.
